Slashdot Mirror
Encryption Exports: Small Step Forward, Big Step Back
Kathleen Ellis, editor of the Privacy News Portal, attended yesterday's press briefing about a proposed loosening of export restrictions, and wrote the following feature article about the current situation. Click below for more.
Actually, let me hit you with a few links before you get started:
- EPIC's page on the proposed Cyberspace Electronic Security Act
- Proposed text of the bill
- White House analysis of the bill - really an executive summary
- Wired coverage, by Declan McCullagh
- Update: Press statements, including briefing transcript
Encryption Exports: Small Step Forward, Big Step Back
by Kathleen Ellis
September 17, 1999
Prominent U.S. Government representatives yesterday announced at a White House press briefing that the President was proposing legislation on encryption policy, and that the Department of Commerce was revising its export restrictions on some encryption products. Last year, Vice President Al Gore vowed to further loosen restrictions and propose a solution to the encryption issue, which has been the subject of contentious debate for the past decade.
The legislation, known as the Cyberspace Electronic Security Act of 1999 (CESA), has been transmitted to Congress by President Clinton. The bill purports to strike a "compromise" between the needs of law enforcement for access to data and the needs of Internet users to secure and their e-mail, web transactions, and stored data from hackers or thieves. According to the text of the bill, "society's increasing reliance on information systems in this new environment exposes U.S. citizens, institutions, and their information to unprecedented risks." Despite this acknowledgement, the bill clearly gives consideration to the needs of law enforcement and intelligence agencies first; "The failure to provide law enforcement with the necessary ability to obtain the plaintext version of the evidence makes existing authorities useless."
One of the major provisions of CESA is to allocate $80 million dollars for an FBI "Technical Support Center", which would provide assistance to federal, state, and local law enforcement officials. The bill also reinforces the confidentiality of law enforcement intelligence techniques used to gather information about suspected criminals. "The Department of Justice has developed this legislation with the assistance of agencies in government," said Attorney General Janet Reno. "Law enforcement has tools at its disposal to fight crime, but those tools are rendered useless when encryption gets involved". Reno said that CESA "balances the needs of privacy and public safety".
Perhaps most the most noteworthy provision of the bill is the resurrection of key escrow, a solution long considered insufficient, insecure and obsolete by experts. Key escrow is a technology that entails entrusting one's private keys with a trusted third party, so that theoretically, a law enforcement official would be able to present that third party with a warrant in order to gain access to the plaintext of the encrypted data. Although the bill does not require domestic users to utilize an escrowed cryptosystem, the bill provides a legal framework to protect users from disclosure of their decryption keys by their trusted third party without a court order. The bill also proposes to implement strict guidelines outlining the circumstances under which a law enforcement agent may be granted access to a decryption key held by the third party.
This mention of key escrow worries privacy activists, who have heard the use of such language by the administration before. "This raises the specter of collusion between law enforcement and industry to build back door access into encryption products," says David Sobel, General Counsel for the Electronic Privacy Information Center. According to EPIC's statement, the bill will eventually "provide a legal framework for access to decryption keys," a prospect which worries many activists and internet users alike.
Sobel would rather see the Security and Freedom through Encryption Act determine the U.S. Government's encryption policy. Authored by congressman Bob Goodlatte, SAFE would essentially force the government to reverse its stance on the encryption issue. Unfortunately, passage of the SAFE Act now seems unlikely, in light of Deputy Secretary of Defense John Hamre's remark during the briefing that if the SAFE Act passes the House and Senate, "the Department of Defense will ask the President to veto it".
Also announced at the press conference were revisions to the Department of Commerce's encryption export policy. According to a report released at the briefing, the export requirements will be revised to allow software exports of products of any key length, after the product is first submitted for review by the Commerce Department, and as long as the manufacturer of the product meets strict guidelines for post-export reporting of any user or distributor who obtains the software directly from the licensee. Secretary of Commerce William Daley announced that that the Bureau of Export Administration would streamline the revision and reporting process, but was unclear about specific changes to the current procedure.
Two prominent industry groups are very enthusiastic about this proposal. "Today's decision articulates a policy that is good for America, good for our nation's high-tech industry, and good for the tens of millions of Americans who use computers and want them to be secure" says a press release from Americans for Computer Privacy, a group that has lobbied for legislative reform and is funded primarily by technology companies. In a statement published by the Computer Systems Policy Project, Sun Microsystems President and CEO Scott McNealy (who made headlines on Slashdot for his remarks telling reporters that the privacy issue was a "red herring" and that "you have zero privacy anyway...get over it") said "we applaud the Administration's recognition that the universal use of strong encryption will promote the benefits of a networked world while protecting Americans' privacy, safety and security,". CSPP is comprised of eleven CEOs from major Information Technology companies, such as IBM, Dell, and Intel.
James Steinberg, Deputy Assistant for National Security Affairs, opened the briefing by praising both groups for thier assistance in authoring the proposal, so it's no surprise that they're eager to ingratiate themselves to the Clinton Administration, while at the same time self-importantly emphasizing their effectiveness by declaring a victory. EPIC's David Sobel says "it appears that the FBI and large computer companies have reached an agreement on encryption, but that is not necessarily in the interest of the average computer user." Any compromise reached by these two groups could result in "less security than advertised, with hidden vulnerabilities the government can exploit".
Secretary Daley was repeatedly asked during the briefing what purpose the one-time review served, and under what circumstances an export license exception would be granted or denied; no clear answer was given. The U.S. Government may wish to allow exports only of flawed or escrowed encryption products using encryption above a certain key length, but have given up on explicitly pursuing that as a goal. Large software companies, the kind represented by ACP and CSPP, have lost a lot of business because of the export restrictions, and with each year that passes they may become less likely to object to making a few changes to their crypto modules in order to finally gain access to the foreign market.
In some ways, this proposal is good for the companies who have existed for so long without the ability to export their stronger security products at all until now, but for the rest of us, the proposal is neutral at best and abysmal at worst. As larger, wealthier proponents of crypto liberalization get what they want and contentedly back out of the debate on this issue (as American banks did when they were granted license exception to export security software to their overseas offices), further positive alterations to export policy start to seem less and less likely to happen. This is bad for American cryptographers who wish to discuss their work with their colleagues on the Internet. It's even worse for users, who may end up using insecure products without knowing it.
It's unclear what will happen at this point. The current congressional climate suggests that CESA will not pass without a significant push from the Clinton Administration. Even if the bill is defeated, however, Internet users around the world should continue to be cautious about purchasing commercial encryption products that originate inside the U.S.; you never know what may be lurking within.
"Law enforcement has tools at its disposal to fight crime, but those tools are rendered useless when encryption gets involved"
What bothers me most about comments like these is that they are based on the assumption that 'law enforcement' has an implicit right to have access to your information, as long as they feel the need. This is not so. A relevant passage:
"The right of the people to be secure in their persons, houses, papers, and effects, against unreasonable searches and seizures, shall not be violated"
Since when does building a back door into all communications qualify as secure? And a promise from law enforcement not to use it improperly is not security, even if they could make such a promise honestly; what happens when someone else figures out how to use the back door (and someone will)?
Another thing that I don't see being brought up much when statements like the above are being thrown about is history. People have been using various types of codes to encrypt sensitive communications for hundreds of years. Has law enforcement been 'useless' for all this time?
I find it (almost) amusing that one of the agencies screaming loudest about their need for this (the FBI) touts as their greatest victory the incarceration of a man who was convicted based on evidence they couldn't decipher. So what did they do? They offered the guy who knew what it meant a deal, and he did it for them. Is there some reason this doesn't work anymore?
I work in crypto QA for a major, evil software company. Guess which one. We've been crossing our fingers for legislation like this due to the extreme cost and instability of shipping both a 128 and a 40/56 bit version of every crypto product. Apart from the effort of testing everything four times (once for hi, once for low, once for interactions, once for upgrades) there is the simple fact that as test matrices grow, bugs proliferate. And some are not found.
We used to say, "If only some bolt of light would strike Clinton upside the head and get him to liberate export policies!" Our premise was that the cost and difficulty of testing would drop, and we would be better situated to promote our client overseas.
NOPE. Even if this law passes, the labor of testing may just go up. Implementing a "backdoor" or a key escrow mechanism necessitates cracking the CSP's (oops - gave away which company) and re-writing practically the entire code structure that selects and manages algorithms. Easy? No. In addition, what foreign company would be interested in purchasing a product they know the US Government can abuse like a bitch at its will? I certainly wouldn't tolerate it.
The upshot? My (uninformed) prediction is this: There will still be 40-bit non-escrowed versions of the product going out the door. These will be shipped primarily to other countries and to paranoid individuals like slashdotters. Everyone else will run 128, but it will be a compromised breed of 128.
In other words, this will accomplish nothing other than weakening crypto for US citizens.
This bill is bullshit! Call or email your congressional office today. I'm about to do that very thing.
-konstant
-konstant
Yes! We are all individuals! I'm not!
Yet another lovely step back in time by the Clinton administration. I wonder if any of the candidates for the next presidential election have gone on record for crypto policy.
The primary reason that the concept key escrow absolutely petrifies me is that the to be useful, the keys need to travel in one form or another from their central repository (which I would hope would be as tightly locked up as the NSA) to the law enforcement agency responsible for unlocking the message. With the repeated demonstrations by the U.S. Government that they don't understand crypto, what's even going to guarantee the safety of my key (and therefore my data) in transit?
Don't make me hand over my keys. I have them because they protect me. And you can bet that if key escrow becomes a requirement, I will not surrender my stock of open-source crypto software, but only begin to use it more.